I think it's nice to have a program like ClamWin with some enthousiasic people working on it and i appreciate the effort spent on it. Unfortunately things went wrong:
After yesterday's update pdf's were seen as virus.
I will write a script for myself to restore these, but please let me know when this problem is fixed, so i will be able to restore it. Thanks in advance.
These are the logfiles (of the update and partly of the scan):

C:\cygwin\usr\share\doc\bzip2-1.0.5\manual.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\doc\bzip2-1.0.5\manual.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\manual.pdf.infected'
C:\cygwin\usr\share\doc\cygwin-x-doc-1.1.0\cg\cygwin-x-cg.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\doc\cygwin-x-doc-1.1.0\cg\cygwin-x-cg.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\cygwin-x-cg.pdf.infected'
C:\cygwin\usr\share\doc\cygwin-x-doc-1.1.0\faq\cygwin-x-faq.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\doc\cygwin-x-doc-1.1.0\faq\cygwin-x-faq.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\cygwin-x-faq.pdf.infected'
C:\cygwin\usr\share\doc\cygwin-x-doc-1.1.0\ug\cygwin-x-ug.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\doc\cygwin-x-doc-1.1.0\ug\cygwin-x-ug.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\cygwin-x-ug.pdf.infected'
C:\cygwin\usr\share\ghostscript\8.63\examples\annots.pdf: PUA.PDF.EmbeddedJavaScript FOUND
C:\cygwin\usr\share\ghostscript\8.63\examples\annots.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\annots.pdf.infected'
C:\cygwin\usr\share\texmf\doc\etex\base\etex-man.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\etex\base\etex-man.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\etex-man.pdf.infected'
C:\cygwin\usr\share\texmf\doc\fonts\marvosym\marvodoc.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\fonts\marvosym\marvodoc.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\marvodoc.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\mfpic\mfpguide.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\generic\mfpic\mfpguide.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\mfpguide.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\mfpic\mfpman.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\generic\mfpic\mfpman.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\mfpman.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pst-3dplot-doc.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pst-3dplot-doc.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\pst-3dplot-doc.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pst-circ-doc.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pst-circ-doc.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\pst-circ-doc.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pst-uml-doc.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pst-uml-doc.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\pst-uml-doc.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pstnews97-15.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pstnews97-15.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\pstnews97-15.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pstricks-add-doc.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\generic\pstricks\pstricks-add-doc.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\pstricks-add-doc.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\pstricks\vue3d-e.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\generic\pstricks\vue3d-e.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\vue3d-e.pdf.infected'
C:\cygwin\usr\share\texmf\doc\generic\xypic\xyrefer.pdf: PUA.PDF.EmbeddedJS FOUND
C:\cygwin\usr\share\texmf\doc\generic\xypic\xyrefer.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\xyrefer.pdf.infected'
C:\cygwin\usr\share\texmf\doc\help\faq\uktug-faq\uktug-faq.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\help\faq\uktug-faq\uktug-faq.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\uktug-faq.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\beamer\beameruserguide.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\beamer\beameruserguide.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\beameruserguide.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample1.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample1.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\beamerexample1.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample2.article.pdf: PUA.PDF.EmbeddedJS FOUND
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample2.article.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\beamerexample2.article.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample2.beamer.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample2.beamer.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\beamerexample2.beamer.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample3.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample3.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\beamerexample3.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample4.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample4.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\beamerexample4.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample5.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample5.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\beamerexample5.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample6.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\beamer\examples\beamerexample6.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\beamerexample6.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\dk-bib\dk-bib.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\dk-bib\dk-bib.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\dk-bib.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\general\l2kurz.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\general\l2kurz.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\l2kurz.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\general\l2tabu.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\general\l2tabu.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\l2tabu.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\general\l2tabuen.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\general\l2tabuen.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\l2tabuen.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\general\lshort.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\general\lshort.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\lshort.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\geometry\geometry.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\geometry\geometry.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\geometry.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\hyperref\manual.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\hyperref\manual.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\manual.pdf.infected.000'
C:\cygwin\usr\share\texmf\doc\latex\hyperref\paper.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\hyperref\paper.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\paper.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\hyperref\slides.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\hyperref\slides.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\slides.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\koma-script\koma-script.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\koma-script\koma-script.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\koma-script.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\koma-script\scrguide.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\koma-script\scrguide.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\scrguide.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\koma-script\scrguien.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\koma-script\scrguien.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\scrguien.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\memoir\memman.pdf: PUA.PDF.EmbeddedJS FOUND
C:\cygwin\usr\share\texmf\doc\latex\memoir\memman.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\memman.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\alphalph.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\alphalph.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\alphalph.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\hypbmsec.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\hypbmsec.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\hypbmsec.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\hypcap.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\hypcap.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\hypcap.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\pagesel.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\pagesel.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\pagesel.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\twoopt.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\oberdiek\twoopt.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\twoopt.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\pgf\pgfuserguide.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\pgf\pgfuserguide.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\pgfuserguide.pdf.infected'
C:\cygwin\usr\share\texmf\doc\latex\psnfss\psnfss2e.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\latex\psnfss\psnfss2e.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\psnfss2e.pdf.infected'
C:\cygwin\usr\share\texmf\doc\pdftex\manual\pdftex-a.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\texmf\doc\pdftex\manual\pdftex-a.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\pdftex-a.pdf.infected'
C:\cygwin\usr\share\X11\doc\core\Xserver-spec.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\core\Xserver-spec.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\Xserver-spec.pdf.infected'
C:\cygwin\usr\share\X11\doc\fonts\fonts.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\fonts\fonts.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\fonts.pdf.infected'
C:\cygwin\usr\share\X11\doc\graphics\dps.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\graphics\dps.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\dps.pdf.infected'
C:\cygwin\usr\share\X11\doc\input\XKB-Config.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\input\XKB-Config.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\XKB-Config.pdf.infected'
C:\cygwin\usr\share\X11\doc\input\XKB-Enhancing.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\input\XKB-Enhancing.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\XKB-Enhancing.pdf.infected'
C:\cygwin\usr\share\X11\doc\Install.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\Install.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\Install.pdf.infected'
C:\cygwin\usr\share\X11\doc\LICENSE.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\LICENSE.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\LICENSE.pdf.infected'
C:\cygwin\usr\share\X11\doc\platforms\Darwin.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\platforms\Darwin.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\Darwin.pdf.infected'
C:\cygwin\usr\share\X11\doc\platforms\NetBSD.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\platforms\NetBSD.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\NetBSD.pdf.infected'
C:\cygwin\usr\share\X11\doc\platforms\OpenBSD.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\platforms\OpenBSD.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\OpenBSD.pdf.infected'
C:\cygwin\usr\share\X11\doc\platforms\SCO.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\platforms\SCO.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\SCO.pdf.infected'
C:\cygwin\usr\share\X11\doc\platforms\Solaris.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\platforms\Solaris.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\Solaris.pdf.infected'
C:\cygwin\usr\share\X11\doc\README.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\README.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\README.pdf.infected'
C:\cygwin\usr\share\X11\doc\RELNOTES.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\RELNOTES.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\RELNOTES.pdf.infected'
C:\cygwin\usr\share\X11\doc\security\XACE-Spec.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\security\XACE-Spec.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\XACE-Spec.pdf.infected'
C:\cygwin\usr\share\X11\doc\Versions.pdf: PUA.PDF.OpenActionObject FOUND
C:\cygwin\usr\share\X11\doc\Versions.pdf: moved to 'C:\Program Files\ClamWin\bin\Quarantine\C-schijf\Versions.pdf.infected'

GuitarBob

Joined: 09 Jul 2006

Posts: 4392

Location: USA

Posted: Mon Apr 25, 2011 12:47 pm

ClamWin uses the scan engine and signatures provided by Clam AV. False positives should be reported to Clam AV at http://www.clamav.net/lang/en/sendvirus/ on the web. When you get to the upload page, be sure to classify the file as a false positive-I believe classification is set to virus. Clam Will adjust the signature within a couple of days.

It is unfortunate, but false positives occasionally happen because malware can use the same code, packers, etc. as "good" programs. Clam Av's false positive "farm," where signatures are checked before release is also not as large as that of many AVs. Is there a possibility you could set ClamWin's infected files option to Report only and configure it to send an email message to you upon detection?

Regards,

Administrator

Joined: 19 Nov 2010

Posts: 6

Posted: Mon Apr 25, 2011 5:29 pm

Hi, thanks for your reply. I wasn't aware of an option to 'report only'. I will check it out tomorrow and configure it and also tell Clam av about the false positives.

GuitarBob

Joined: 09 Jul 2006

Posts: 4392

Location: USA

Posted: Mon Apr 25, 2011 7:52 pm

You only need to send one file when there are multiple false positives for the same virus.

Yesterday I saw that someone had reported some PDF false positives to Clam. I don't recall the false detecton's name, but I suspect it was the same one as you have. It should be corrected within a couple of days (long weekend, unfortunately).

If you are running ClamWin version .97 on Vista or Windows 7 boxes, you can use the ClamWin Quarantine Browser (start, all programs, ClamWin, quarantine browser) to restore falsely-quarantined files. Before the next scan though, you should exclude the falsely-detected files via ClamWin's filters (configure, filters from the system tray icon).